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REMARKS 

This Amendment and the following remarks are intended to fully respond to the Final 
Office Action dated October 5, 2004. In that Office Action, claims 1-46 were examined, and all 
claims were rejected. More specifically, claims 1-12, 20-25, and 28-36 stand rejected under 35 
U.S.C. § 103(a) as being unpatentable over Scheifler et al. (USPN 6,138,238), in view of Shrader 
et al. (USPN 6,526,513); claims 13, 14, 17-19, 26, 27, and 37-46 stand rejected under 35 U.S.C. 
§ 103(a) as being unpatentable over Scheifler, in view of Jerger et al. (USPN 6,345,361). 
Reconsideration of these rejections, as they might apply to the original and amended claims in 
view of these remarks, is respectfully requested. 

In this response, no claims have been amended, and no claims have been canceled. No 
new claims have been added. Therefore, claims 1-46 are pending in this application. Further, 
the specification has been amended to correct a typographical error. 

Claim Rejections - 35 U.S.C $ 103 

Claims 1-12, 20-25, and 28-36 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Scheifler et al. (USPN 6,138,238), in view of Shrader et al. (USPN 6,526,513). 
The Applicant respectfully traverses the rejections since the Examiner has failed to establish a 
prima facie case of obviousness. In order to establish a prima facie case of obviousness, the 
Examiner must establish: 1) some suggestion or motivation, either in the references themselves 
or in the knowledge generally available to one of ordinary skill in the art, to modify the 
references or combine their teachings; 2) a reasonable expectation of success of such a 
modification or combination; and 3) a teaching or suggestion in the cited prior art of each 
claimed limitation. See MPEP §706.02(j). As will be discussed in detail below, the references 
cited by the Examiner fail to teach or suggest each claimed limitation. Specifically, the 
references, alone or in combination, fail to teach or suggest dynamically overriding permissions 
so that a stack walk can be cut short. Further, the Examiner does not provide evidence that the 
suggestion or motivation to modify or combine the reference cited is explicit or implicit in the 
reference cited. Further, the Examiner does not provide any evidence that knowledge of one 
skilled in the art would provide the suggestion or motivation to modify or combine the reference. 
Finally, the Examiner does not provide evidence of a reasonable expectation of success of such a 
modification or combination. 
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To review, Scheifler relates to a system which regulates access to resources requested by 
an operation executing on a computer. The system includes a policy file, a call stack, and an 
execution unit. The policy file stores permissions for each of the resources. The permissions 
authorize particular types of access to the resource based on a source of the code and an executor 
of the code. The call stack stores representations of the methods and executors in an order of 
invocation by the operation. The execution unit grants access to the resource when the types of 
access authorized by the permissions of all of the methods and executors on the call stack 
encompass the access requested by the operation. 

In contrast, Shrader relates to an architecture for extending the Java security model to 
allow a user or administrator to grant permissions dynamically. Shrader allows Java applets and 
applications to dynamically prompt the user to grant a permission that does not exist in the Java 
policy file. Dynamic and denied permissions may be permanently stored in a policy file so that 
they take effect across browser sessions. Depending on the configuration of the Java Security 
file, users can specify if the applet or application should prompt the user to grant or to deny a 
permission, not prompt and grant all or deny all permissions, or not prompt and operate with the 
regular Java 2 model of throwing an exception if a permission has not been granted. 

Neither Scheifler nor Shrader, alone or in combination, teach the dynamic override 
feature claimed by the present invention. Scheifler actually teaches away from a dynamic 
override: "An action is authorized only when all the protection domain objects associated with a 
thread include the permission required at the time that the request is made," Col. 19, lines 56-59 
(emphasis added). More specifically, in Scheifler, a loop is defined in which permissions 
associated with frames in the call stack are checked. "The loop continues until a privileged 
method is encountered, or all the frames in the call stack have been checked." (Col. 18, lines 32- 
34). In Shrader, overrides are stored in one or more files, and not in the stack itself. As a result, 
and as can be seen in Figure 3 of Shrader, all classes in a stack are checked regardless of whether 
the user has supplied an overriding value. In contrast, the present invention stores overrides in 
the call stack itself, such that an override encountered during a call stack walk precludes any 
further walking. There is no teaching or suggestion in Scheifler or Shrader, alone or in 
combination, of cutting the stack walk short because of a dynamic override. 

As Scheifler and Shrader do not, alone or in combination, teach the claimed dynamic 
override feature, and Scheifler actually teaches away from the combination, reconsideration of 
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the § 103(a) rejections of independent claims 1, 20, and 28 is respectfully requested. Likewise, 
claims 2-12, 21-25, and 29-39 depend from those claims, and should be allowed for at least the 
same reasons. 

Claims 13-19, 26, 27, and 37-46 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Scheifler, in view of Jerger et al. (USPN 6,345,361). The Applicant 
respectfully traverses the rejections since the Examiner has failed to establish a prima facie case 
of obviousness. In order to establish a prima facie case of obviousness, the Examiner must 
establish: 1) some suggestion or motivation, either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art, to modify the references or 
combine their teachings; 2) a reasonable expectation of success of such a modification or 
combination; and 3) a teaching or suggestion in the cited prior art of each claimed limitation. 
See MPEP §706.02(j). As will be discussed in detail below, the references cited by the 
Examiner fail to teach or suggest each claimed limitation. Specifically, the references, alone or 
in combination, fail to teach or suggest dynamically overriding permissions so that a stack walk 
can be cut short. Further, the Examiner does not provide evidence that the suggestion or 
motivation to modify or combine the reference cited is explicit or implicit in the reference cited. 
Further, the Examiner does not provide any evidence that knowledge of one skilled in the art 
would provide the suggestion or motivation to modify or combine the reference. Finally, the 
Examiner does not provide evidence of a reasonable expectation of success of such a 
modification or combination. 

As discussed above, Scheifler relates to a system which regulates access to resources 
requested by an operation executing on a computer. The system includes a policy file, a call 
stack, and an execution unit. The policy file stores permissions for each of the resources. The 
permissions authorize particular types of access to the resource based on a source of the code and 
an executor of the code. The call stack stores representations of the methods and executors in an 
order of invocation by the operation. The execution unit grants access to the resource when the 
types of access authorized by the permissions of all of the methods and executors on the call 
stack encompass the access requested by the operation. 

In contrast, Jerger relates to a model for managing active content downloaded from a 
computer network. The security model includes the configuration of a system security policy that 
is stored on a host computer. The system security policy is configured by security zone in 
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progressively "finer grain" levels with each level associated with and defining the previous level. 
These levels may include: protected operations; user permission sets, permissions, parameters 
and primitives associated with parameters. A requested permission set is provided by the 
publisher of active content that lists the permissions that the active content requires in order to 
run on the host system. The requested permission set is automatically compared to one or more 
user permission sets to determine the permissions, if any that will be granted on the host system. 

Neither Scheifler nor Jerger, alone or in combination, teach a cached permission 
intersection claimed by the present invention. Scheifler makes no reference to a cached 
permission intersection, and Jerger explicitly teaches away from using any such caching 
functionality: "In this regard, it has been determined empirically that attempting to 'memorize' 
comparison results and intersection notations from commonly reprocessed locations is not 
worthwhile, since it impedes the comparison process and the redundant notations are relatively 
inexpensive (in terms of memory) to keep anyway." Col. 58, lines 32-37. 

Therefore, a prima facie case of obviousness has not been established, and 
reconsideration of the § 103(a) rejections of independent claims 13, 26, and 40 is thus 
respectfully requested. Likewise, claims 14-19, 27, and 41-46 depend from those claims, and 
should be allowed for at least the same reasons. 
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Conclusion 

It is believed that no further fees are due with this Response. However, the 
Commissioner is hereby authorized to charge any deficiencies or credit any overpayment with 
respect to this patent application to deposit account number 13-2725. 

In light of the above remarks and amendments, it is believed that the application is now 
in condition for allowance, and such action is respectfully requested. Applicants believe that this 
response and amendment fully addresses each of the Examiners rejections. Should any 
additional issues need to be resolved, the Examiner is requested to telephone the undersigned to 
attempt to resolve those issues. 




Timothy B. Scill, Reg. No 42,137 
MERCHANT k GOULD P.C. 
P.O. Box 2903 

Minneapolis, MN 55402-0903 
303.357.1648 
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